A sitemap for any site, including one built by hand
Last updated
The short answer
A sitemap is a file listing the pages you want search engines to find. Most site builders make one for you at /sitemap.xml. If your site was built by hand, nothing makes it: write a short XML file listing your real pages, put it in the site's top folder, name it in robots.txt and submit it in Google Search Console.
What a sitemap is
A plain XML file, defined by the sitemap protocol, with one <url> entry per page and its full address in <loc>. It can also carry a <lastmod> date for when the page last changed.
What it doesn't do: Google says a sitemap is a hint, not a guarantee that the pages will be crawled or indexed. Google uses <lastmod> only when it is consistently accurate, and ignores <priority> and <changefreq>.
Why it matters to a small business
Search engines find most pages by following links. A small site with clear menus may be found without a sitemap, but a sitemap removes the guesswork: a new service page, or one linked only from a footer, is on the list from the day you add it. It is also where Search Console reports which listed pages made it into Google and which didn't, and why.
How the free scan decides
- XML sitemap fails when the scan finds no XML sitemap, neither at
/sitemap.xmlnor named in robots.txt. - The sitemap in robots.txt loads fails when robots.txt names a sitemap that doesn't load.
- Sitemap URLs actually work fails when pages listed in the sitemap return errors, and Sitemap URLs are indexable when it lists pages marked noindex or whose canonical tag points somewhere else.
- Sitemap freshness dates looks for
<lastmod>dates, and whether they ever change. - Your site is connected to Google Search Console is for information: it looks for a Search Console verification on the homepage or in your domain's DNS. Search Console can also be verified in ways the scan can't see, so this one never costs you points.
A footer link called "Sitemap" that opens a page of links is helpful to visitors, but it is not the XML file search engines read.
Where builders put yours
- WordPress makes one at
/wp-sitemap.xml. An SEO plugin usually replaces it with its own, often at/sitemap_index.xml; the plugin's settings say where. - Shopify, Wix and Squarespace make one at
/sitemap.xmland keep it up to date as you add pages. There is nothing to write; submit it in Search Console. - A page hidden in the builder's settings (hidden from search, or set to noindex) is usually left out of the builder's sitemap, which is what you want.
Writing one by hand
For a site written in HTML, PHP or ASP.NET with no plugin to do it, the file is short enough to write yourself:
- List the pages a visitor should be able to land on from a search: the homepage, each service or product page, about, contact. Leave out baskets, account pages, search results, thank-you pages and anything marked noindex.
- Use each page's one proper address, the one in its canonical tag:
https://, your chosenwwwform, no redirect in between (the one-address guide explains why). - Save the list as
sitemap.xml, in UTF-8, in the same folder as your homepage. On Windows hosting (IIS) that is the folder withweb.configin it. - Add
<lastmod>only if you will keep it true: the date you last really changed that page's content, not today's date on each entry. - Open
https://yoursite.com/sitemap.xmlin a browser and check it shows the list, not your "page not found" page.
<?xml version="1.0" encoding="UTF-8"?>
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
<url>
<loc>https://www.yoursite.com/</loc>
</url>
<url>
<loc>https://www.yoursite.com/services/</loc>
<lastmod>2026-09-30</lastmod>
</url>
<url>
<loc>https://www.yoursite.com/contact/</loc>
</url>
</urlset>One file holds up to 50,000 addresses, far more than a small site needs. When you add or remove a page, update the file at the same time, so it never sends search engines to a page that has gone. When the free scan finds a hand-built site with no sitemap, the finding includes a starting file listing the pages the scan reached, to check and save.
Telling Google about it
- Add one line to your robots.txt, with the full address:
Sitemap: https://www.yoursite.com/sitemap.xml. Search engines read robots.txt before they crawl, so this is where they find the sitemap. - Add your site to Google Search Console and verify it. The Domain option, with a TXT record where your domain's DNS is managed, covers each form of your address at once; Google's verification help lists the other ways. Leave the record in place: Google checks it again later.
- In Search Console, open Sitemaps, enter the sitemap's address and submit it.
How to check yours
The free robots.txt checker shows whether your robots.txt names a sitemap. The free scan goes further: it opens the sitemap, requests a sample of the pages in it and lists any that fail or are marked noindex. In Search Console, the Sitemaps report shows how many listed pages Google has found.
Checklist
/sitemap.xml(or your platform's address for it) opens and lists your pages.- It lists only pages that load, at their proper https addresses, with no noindex pages.
- Dates in it are the days pages really changed, or there are none.
- robots.txt names it with a full address, and that address loads.
- Your site is verified in Search Console and the sitemap is submitted there.
- On a hand-built site, someone updates the file when pages are added or removed.
What the free scan checks for this
These are the FocalScore checks that cover this guide's subject. Each one in your report says what it found, shows the evidence and gives the fix.
- XML sitemap
- The sitemap in robots.txt loads
- Sitemap freshness dates
- Sitemap URLs actually work
- Sitemap URLs are indexable
- Your site is connected to Google Search Console
Sources
Last checked . Documentation, settings and rules change; if one of these pages now says something different, it is right and this guide is out of date. Tell us at info@focalscore.com.
- Google Search Central: Build and submit a sitemap
- sitemaps.org: The sitemap protocol
- Google Search Central: Introduction to robots.txt
- Google Search Console
- Search Console Help: Verify your site ownership
More guides
- How to get your business recommended by ChatGPT and other AI assistants
- Why AI assistants can't see your website, and how to fix it
- robots.txt for small businesses: what to allow, what to block
- IndexNow explained: tell Bing about new pages, and who doesn't use it
- The pages every small-business website needs
- How to turn more website visitors into enquiries
- Why your site is slow, and what to fix first
- How your business shows up in Google: titles, descriptions and headings
- One address for each page: www, https, canonical tags and redirects
- Making your site usable by everyone
- Making your site work on a phone
- Security settings for a small-business website, by platform
- Stop people sending email as your business: SPF, DKIM and DMARC
- Cookies and consent: what your site sets and when you need a banner
- How your links look when people share them
- Getting your business details right for Google Maps and AI assistants